The Package That Doesn't Exist

Coding models invent package names that exist in no registry. Most are one-offs — but 43% reappear on every re-run, and a stable hallucination is a name an attacker can register and wait for.

Why this, for you: an agent that writes uv add or npm install commands is a supply-chain actor. Slopsquatting turns the model's training-distribution bug into an install of attacker-controlled code. You can't prompt the hallucination away — so the defense is the install authority, not the model.

Slopsquatting: an LLM recommends a package that exists nowhere, an attacker pre-registers that name on PyPI or npm, and the agent's install pulls the malware. The term — coined by a Python Software Foundation developer-in-residence — is "AI slop" plus "typosquatting." The package doesn't exist until an attacker creates it.

1 The persistence is what makes it economic

Spracklen et al. ran 576,000 code generations across 16 models and checked every recommended package against the registries:

Measurement	Result
Hallucination rate — commercial models	5.2%
Hallucination rate — open-source models	21.7%
Names reappearing in every one of 10 re-runs	43%
Names ≥6 Levenshtein distance from any real package	48.6%

Random per-call hallucinations would be unexploitable. The 43% persistence turns "predict the model's next recommendation" into a tractable enumeration problem — an attacker re-prompts at scale, collects the recurring names, and registers the top-N first.

2 Why typosquat detectors miss it

Registry-side typosquat heuristics key off small edit distance from popular names. But 48.6% of hallucinated names sit Levenshtein distance ≥6 from any real package — they're not typos, they're plausible syntheses. The detectors look for the wrong shape. The proof of concept is concrete:

huggingface-cli: >30,000 downloads in three months

Bar Lanyado registered huggingface-cli on PyPI as a benign empty artifact after seeing LLMs repeatedly recommend it in place of the real huggingface-hub. Within three months it received >30,000 authentic downloads and was pulled into the README of Alibaba's GraphTranslator as an install dependency. The payload was harmless — but it confirmed a hallucinated name on a public registry gets installed at scale, by humans and build pipelines alike.

3 Gate the install authority, not the model

The hallucination prior can't be prompted away, so every defense routes around it by gating install:

# Lockfile-enforced install fails closed on any unendorsed name $ npm ci npm error code E404 npm error 404 Not Found - GET https://registry.npmjs.org/arrow-to-pandas # the lockfile never resolved the name — the vector closes

Lockfile-enforced installs (npm ci, uv pip sync with hashes), an internal mirror that refuses unknown upstream packages, a pre-install existence + provenance check, or removing the install leg entirely and requiring a human-reviewed PR — each closes the vector. The defense to not invest in is registry-side typosquat detection; the edit-distance distribution shows it misses the bulk of the surface. Where lockfiles or curated mirrors already run, the slopsquatting-specific check is redundant — exposure concentrates wherever an agent's install authority bypasses that hygiene.

↪ Your win: the install path decides the outcome

Treat the agent's manifest as a hint — validate names against an authoritative registry, not the model's prior.
Enforce lockfile installs — npm ci / uv pip sync fail closed on any unendorsed name.
Gate or remove install authority — require a human-reviewed PR for manifest changes.
Skip edit-distance detection — 48.6% of hallucinated names are too far from real ones to catch.
Know where it bites — the long tail, not top-1000 libraries; thin manifests have minimal exposure.

Retrieval practice — recall, don't peek

Question 1What makes slopsquatting economically viable for an attacker is that…

Question 2Registry-side typosquat detectors miss most slopsquatted names because…

Question 3The Lanyado huggingface-cli PoC showed that a hallucinated name…

Question 4The durable defense against slopsquatting is to gate…

Question 5 · spaced recall from Lesson 12Workload Identity Federation replaces a static API key with…

Ask me anything. Want to add a pre-install existence check to your agent's uv add hook, or audit which of your pipelines install outside a lockfile? Next, the last content lesson: The URL Is the Leak — exfiltration through the request itself.